10
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73373 | Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre. | HIGH | 8.9 | 0.3% | 45 |
No patch
|
| CVE-2026-71574 | Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session. | HIGH | 8.5 | 0.3% | 43 |
No patch
|
| CVE-2026-73337 | Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users. | HIGH | 8.2 | 0.3% | 41 |
No patch
|
| CVE-2026-71573 | Improper CORS origin validation in Joomla! CMS versions 4.0.0-5.4.7 and 6.0.0-6.1.2 allows remote attackers to bypass the configured origin allowlist and make unauthorized cross-origin requests. The CWE-93 (CRLF Injection) classification indicates the bypass mechanism likely involves injecting carriage-return/line-feed characters into the Origin header to confuse the server's string-comparison logic, rather than a simple misconfiguration of the allowlist itself. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, zero-privilege, low-complexity nature of the flaw makes it exploitable at scale against Joomla sites where CORS is configured. | MEDIUM | 6.9 | 0.3% | 35 |
No patch
|
| CVE-2026-72532 | Joomla! CMS exposes a broken access control flaw on its webservices API category endpoints, permitting users who lack the requisite ACL permissions to create content categories they are explicitly not authorized to manage. The issue spans a large installed base across two major release lines: versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 are confirmed affected. No public exploit code has been identified and the vulnerability does not appear in CISA KEV, but the flaw is network-accessible, requires no complex conditions to trigger via the webservices interface, and was reported directly by the Joomla project. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-72531 | Improper access control (CWE-284) in the custom fields webservice API of Joomla! CMS 4.0.0-5.4.7 and 6.0.0-6.1.2 allows authenticated high-privilege users to create custom fields for components whose ACL restrictions should deny them access. The flaw represents an authorization bypass at the API layer - the REST webservice endpoints for custom fields do not enforce the same component-level ACL checks applied in the web UI, creating a privilege boundary discrepancy. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 with PR:H reflects that exploitation is constrained to already-authenticated, elevated users. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-73336 | Cross-site scripting in Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 exposes sites to stored XSS through improperly escaped schema.org structured-data markup output. An attacker holding high-privilege CMS credentials can inject malicious script into schema.org content fields, which subsequently executes in the browsers of users who load affected pages. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; a vendor security advisory has been issued through the Joomla Security Centre. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-73371 | Improper ACL enforcement in Joomla! CMS batch copy functionality allows authenticated backend users to copy content items they do not have edit permissions for, effectively bypassing content-level access controls. Affected versions span two active release branches: 4.0.0-5.4.7 and 6.0.0-6.1.2, covering a broad portion of active Joomla deployments. No public exploit code exists at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-73372 | Improper access control in Joomla! CMS 5.1.0-5.4.7 and 6.0.0-6.1.2 leaks restricted contact data into schema.org structured data snippets embedded in page output. The CMS fails to enforce ACL rules during schema.org contact snippet generation, allowing contact details for items that should be inaccessible to be injected into structured metadata visible in page source. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV. | MEDIUM | 5.1 | 0.3% | 26 |
No patch
|
| CVE-2026-71572 | Response header injection in Joomla! CMS download views affects all 3.x releases from 3.0.0 through 5.4.7 and the 6.x branch from 6.0.0 through 6.1.2, enabling a high-privileged attacker to inject arbitrary HTTP response headers into download responses. The missing output sanitization in multiple download view handlers exposes end users to Reflected File Download (RFD) and content-type confusion attacks, where a browser can be tricked into treating a server response as a dangerous executable file. No public exploit code has been identified at time of analysis, and CISA KEV status has not been confirmed. | MEDIUM | 4.8 | 0.3% | 24 |
No patch
|